Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2630 Thanks!
[Music]
okay um so uh sorry for the slight delay
so please give a big hand to dash who's
going to do the next talk about service
location protocol denial of service
amplification attacks and um yeah he has
a co-speaker as you can see G um so it's
a stand in but he'll explain that
himself so big hand for
dash
yeah hello thanks nice to be here
um yeah I'm here for the uh service
location protocol uh dos amplification
attacks maybe you have heard or read uh
about it if not well I will talk about
it
now who are we normally this is a two
guys talk actually uh crypto who is not
here today so I brought me uh gel from
the G Village thank you very
much
GFF uh so yeah crypto is not here for uh
today but me which is
Dash short profiling so Cryptor is uh
working at bits side and he is uh well
quite in network protocols and all kinds
of security also Hardware you can you
you can reach him at uh Twitter at
crypto orx aing orine at proton mail and
myself Das I'm also interested Network
protocols and some other things of
security I'm working at CAC and also uh
L
trainings and my Twitter handle is user
to root disclaimer um as Pedro is uh so
Pedro is crypto as he is working uh at
bits side and I'm working at QC we
decided to make a joint research Arch So
This research was done by two companies
bide which is located in us and CC which
is located in
Germany uh of course I do not uh
encourage you to do any sorts of illegal
dos attacks or whatsoever how however if
you want to research those things which
have to be researched and uh you must do
uh and if you want to do it in the
internet please be very calm with that
um in the sense of there are also other
devices on uh devices on your way so you
have other routers switches whatsoever
on your path if you're for instance
researching one certain vulnerability it
might even affect another device in
between so be very cautious with that um
yeah and I'm not do work in uh the Dos
field so I'm not in uh dos defenses or
something like this which does exist
nowadays I've learned a little bit from
those guys who do that professionally um
yeah but uh also I'm not very I wasn't
interested in us stuff uh it seems like
uh yeah that this things came now to me
uh also with another work but we are
talking today about the SLP thingy so
table of contents um in the description
for this talk today I also was thinking
first of uh doing a introduction on the
US but then I recognized that the talk
would be much too long so if you have
time afterwards and you are interested
in some other things in regard of that
you can ask me uh also I know that there
was another guy also talking about dos
Basics here so maybe you also want to
watch his talk um I see yeah talking
about it so we are focusing here on what
SLP is how the attack work what else you
can do and that's basically
it so what is SLP SLP stands for service
location protocol we are uh skiing a bit
through the specification
then how much devices are there and what
the services
are first things first it was defined in
the uh end of the '90s so it's now more
than uh yeah I think 25 26 years old um
it has a well defined Port which is 400
uh uh
27 listening on UDP and
TCP uh there are two versions there's
version one and version two however
version one at least in the internet is
not um um is in small numbers only there
so we focused on version two or we focus
you on version two um SLP itself uh is
for me something uh like an uh you can
think of as an address book for devices
in the internet uh not in the internet
actually as an address book and uh I
tried for myself to understand it a bit
more or its purpose to compare it a
little bit like an active directory mdns
service like this so but we will talk
about the different attributes later and
saying um or talking about the internet
it states uh already in the RFC which is
uh the last bullet point it's uh
probably not a good idea to be be
available available on the internet the
service location protocol provides a
dynamic configuration mechanism for
application in local area networks so
the thing is
it's not even possible or hard to do to
do a real address book for the internet
right I mean we are trying this with DNS
already
and uh so this was always intended to be
internally SLP itself has like three
major Services one is the UA the user
agent um which is usually looking for a
service and then there's the service
agent which should um
be a device which is announcing itself
or one or more services and then is the
directory agent which should like taking
this information and spreading it later
however
um those things are have been mixed up a
bit and so um I to took this note also
from Wikipedia which also did reflect
our experience which says today most
implementations are demons that can act
as both user and a service agent and
they also can be configured as a DA
which is the directory agent so this
would be the normal communication flow
as it had been intended by the rfc's
right so we support uh multicast and
unicasts and you can talk to a service
agent to a directory agent and one of
them should give you back information
and the other one stores it and when we
started to investigate in it we figured
it's much too complicated and made for
several devices we also found no sense
so what we did we um thinking of it much
more simplified and saying okay look we
have a user agent which is the client or
the attacker and then we have a service
which speaks SLP which is vulnerable and
those who are which are not or which we
can use for this sort of
attack yeah to make it
simple the
headers so this
is version two only
it has um several op codes you can see
uh everyone who has ever seen um IP UDP
TCP whatsoever icmp protocol header um
guess uh can read it easily we have the
version the operation code the length
and so on and so
on for the attack itself actually
several operations are
interesting the four shown here are
actually just an example there is even
another one actually two others which
are interesting for this we are focusing
on service type request and service type
reply which is the up code 9 and 10 it's
a little bit it's a little bit more down
there the reason for this is obvious it
is a request and a
response however to make things special
and this is why SLP in this uh whole
amplification thing is a bit more
special uh is that we have op code which
is called a Service registration
and also deregistration but this is
another topic as well so keep those in
mind how much is the spread it well
obviously I said it already it should be
only in local area networks but uh as it
happened to be it is an a lot of other
places as well um notably in the
internet
and this is most probably because well
people just Place their Dev their
devices there and the service is enabled
although most people probably don't even
know about it just a short question who
know before this talk before 10 minutes
ago that SLP
exists I would say it's five people
around like maybe don't know how many
people sitting here but it's not the
most yeah right I I understand that so
it's uh that's the interesting thing
about SLP it's uh it's there it seems
not really to be used anymore it just it
never kicked really off and but it's
still in the
internet okay how much devices uh in
February we had uh
around
50k
then um this uh random ransomware group
came and exploited a hep exploit in SLP
this is when and most people just
recognize
whoop I there's there's a service with a
one or twoyear old Buck I have forgotten
to patch uh or to disable the other
service and
um this was also the a good time you
thought uh now to publish this other
vulnerability then in May um we did uh a
first time presentation of this uh at uh
Berlin sites hey Berlin sites
and there it was still 39,000 SLP
speaking devices uh UDP um service
listening in the internet and then in
August uh when I checked last time 3,000
less
so just because they speaking SLP
doesn't necessarily mean they are also
vulnerable at least not for the priming
part of the
attack um there this is a map of all the
revises uh
entities we identified over the world um
which are affected by this um so as you
can I don't know if you can read it most
probably not uh but it's uh basically
all sorts of uh Industries you can
imagine and what you can not see is that
for instance in South America there's a
lot not identified also not in India but
uh like the most impacted is of course
North North America Europe parts of of
uh and parts of uh
Asia some things about the devices and
services itself um we gathered uh more
than 600 different fingerprints I will
show you in a second what a what I'm
referring to a fingerprint in that
regard right now and most of the things
so the most count have been VMware esxi
but there were also printers yeah
something happened
h no
great thank
you okay so uh we exi is uh one of the
most remot devices stands out completely
and then there is a lot of printer stuff
some strange devices you've never seen
some quite old routers from taian which
is planex and then a lot of ipmi devices
um so like uh super micro Lenovo IBM and
then there had been one device which was
quite interesting for me I just had just
investigated it for some hours which was
very funny maybe one of you guys is
interested in as well to research it
it's a broadcom
LSI RAID controller which uh yeah um can
be reached
and that's not a lot I think maybe 100
maybe 200 I'm not sure uh in the
internet but well you get rate
access so funny
thing identification only with the SLP
answers is not always that easy so of
course we try to support our
identification with with other services
running obviously like web servers or
maybe as AG whatever was in there and to
be quickly able to identify some things
what you can see here is uh the
fingerprint I was talking about this is
a classic answer from a requ uh from a
response from the SLP protocol um as you
can see um Place one is VM
infrastructure then we have VM
infrastructure vbm
wbm and uh well I don't recall what the
third thing was ipmi is obvious then we
had the K minala the VLAN app or wln app
was if I remember correctly uh the
planex routers and yeah we have some
Lenova stuff on the left side you see
the different versions of the esxi
there's two things the first thing is
for identification SLP is awesome
because there's another um operation
which is attribute request and with this
one you can even fingerprint uh pretty
pretty nicely the device um in the case
of esxi it gives you the version number
and uh I think some internal Mech
addresses and alike in regard of other
devices it's other information sometimes
you get like this amount of
data no that's the wrong direction let's
go here though some screenshots just of
uh devices which were running SLP uh for
everyone who have you ever managed a a
server dedicated server or had for what
reason ever access to ipmi uh interfaces
uh knows that that's a super micro then
it's basically the same just na
vendor the same the same this one was
sunny for a second because of course
obviously you recognize it's pretty
similar and then it hit me yeah right
Lenovo took over IBM and they just
rebranded
it um um and then
e6i so this whole talk is about the
vulnerability and now I start with the
vulnerability at the end every SLP
implementation running UDP is vulnerable
of
course why is that because we know UDP
allows us without any sort of handshake
in before to reach the application layer
right and quite indifference if you
think about TCP TCP will never do that
as long as you're not able to guess uh
uh sequence random numbers or you have a
broken number uh random number generator
or another one of the awesome bugs
which do exist
but basically for TCP you need a freeway
handshake and UDP does not so we always
reaching the application this means as
we can set our headers we can also
change our source addresses which in is
uh in the IP layer so we can spoof so we
have
reflection now if the response I trigger
through the reflection is uh bigger as
my request I have an
amplification SLP also supports UDP we
get bigger
replies than our requests are so we have
a reflected deny of service ation
attack um as this is a known issue for
for basically since they're existing
people discuss and try to figure that
out uh how this is working and there's
uh um how how to prevent and check out
which network networks still
support Source IP
spoofing
um there is this uh organization kaida
which is checking for this and this is
also where this picture has been taken
from so you can see that there is still
a percentage of uh networks where you
can send from uh spoof packet so I don't
know if any of you guys uh have ever
tried to send a spoof packet but uh if
you do you might sooner or later
recognize that either the package uh is
not reaching your target
or well um it shows your IP address in
there so this is because providers
started to change the uh uh we're
looking out for that stuff so if you're
interested in that and which networks do
and which not you can check at
kaida there is of course a discussion
why networks still allow that I won't go
into that
discussion just for your
information the reflection itself so uh
I said we talk about a service type
request you can see again the header and
the picket length uh yeah the picket
length this is just without priming so
priming is uh the term what I learned
from those uh dos guys which are
defending actively things they said so
what you're doing there like loading up
the SLP uh directory agent we call
priming so this is why I say this is
without priming this is a normal request
which has like 29 bytes and it's just
asking for the services the device has
and then you get a reply uh which is 6
seven byes so we have an amplification
not a big one but exists but it exists
you can also see again the answer is
down there you see the service type list
length that's a second from uh below and
which is 47 bytes and you see that is a
VM infrastructure again right so you
also can imagine just for the basics of
amplification let's go back some
slides right even the bigger already the
response would be here on this page
where what we call fingerprints uh there
even a simple amplification would be
possible yeah um this is a picture which
uh sh uh describe the whole process
again so we have the attacker which is
on the left side which is doing the
service type request um and says like
yeah I'm some uh this looks like a
Google DNS or something like this and
sends it to the reflector the reflector
is the device down there in the middle
and the reflector gots gets that and uh
responses to uh this other service
that's just a classic
amplification like you can also find it
in other protocols like uh DNS uh
ntp MCD SNMP and so on and so on
now is there space for more is there
room for more more yes this should be a
video but as this is not my device
because of the technical issues there's
no video but I think the picture
explains it
anyways so what is the SLP amplification
thingy there is the arbitrary Service
registration the as you recall this is
op code number three from the protocol
and this is a special thing because what
you can do now is you can remotely
register another
service yes yes
this is like the the the face P nice why
are you doing that so what this mean is
um what does this mean this means um we
can add another URLs this would be also
funny if any device is
really working with this SLP demon but
for us for this sort of attack this is
also funny because it means we can put a
lot of new data in and this data is
later
reflected there is actually also some
some crypto things in there but what and
and sort of authentication but we have
not really found it so uh our our major
impression uh as was that SRP is sort of
uh abandoned sort of I mean there was if
I recall correctly since 2013 now
additional development in the uh open
SLP services at least obviously VM had
to create some patches for the he over
flows are introduced but well that's it
so conclusion long story short in
practice everyone uh and his dog or
giraff everyone and his giraff can add
extra
Services how we do that now um here you
can see the uh service reg uh
registration header and a v shark
extract of it the blue background thing
shows you the new registered
service
um as you can see this is a classic
scheme in that case it's just SLP loow
test and then we have two dots SL slash
name a port and then just some random
data and this is uh what you can do as
long as a directory uh service or the
um uh yeah the the SLP service is uh
taking the data you just can put it in
there so we put that thing together
right we have this uh address thing we
can uh uh we have this uh service
registration thing we can do plus we can
Define for how long it has to be in
there so you can even say okay I just
want this information to be there for
like 1 hour and then it's gone and here
we
go now this is uh by SLP special uh
everything I said in the last five
minutes in one
slide before we start with the uh
reflection we load up our
reflector we add Services Services
Services Services as soon as it's full
or as soon as I know I cannot fill up
anymore data because we what we figured
is that although we had Services which
had like uh space for up to uh
65,535 bytes uh of uh maximum data so 16
bits um I so bytes but 16 bit field uh
so we also figured that some devices
especially also VMware were stopping at
certain levels so if you tried to add
more data than let's say one 1K so one
10,000 bytes it was like yeah okay I
don't uh do that right now anymore and
was just sending back 4,000 bytes so you
also have to check a little bit out uh
when you do the priming uh what sort of
device you are priming so after you have
primed and added some extra data you
just do the uh classic reflection thing
and uh in this particular case uh we
raised the possible amplification Factor
uh from 12 to
2,230 which is already quite
big um actually it is next to mkd if I'm
uh informed correctly uh one of the
biggest amplification thingies uh
possible right now and uh also next to
that uh there are still devices in the
Internet
available here would be here could be
another
video yeah um this is uh a picture
explaining um how much uh traffic for
instance with uh I think this is one
threaded only could be possible with
abusing uh several
devices and um that there is indeed some
amplification
potential yeah the disclosure thing uh
responsible disclosure is always fun I
guess everyone who ever tried it knows
uh that it
is uh as there were a lot of products in
wolv you thought okay it would be nice
to go with uh someone who's uh taken
care of most of this stuff in this case
it was ceson
um which was uh which is an if you don't
know an organization in the states I
think it's cesar. goov and they uh took
care of informing the vendors and yeah
that's what they did 1,700 vendors had
been informed um there were several
discussions with VMware um that
uh to explain what was uh going on um
about the um yeah about those issues and
there had a lot had been a lot of
meetings with
Cesar yes and
then as you know in the process of
disclosure you have a date when things
are published and short before uh this
thing had to be published uh Krypto
reached out also to some other friends
of him who are working in this field and
is like look guys uh we are publishing
now this SLP thing uh you know you know
about that right no they did not knew
which was pretty funny so they were um
were quite surprised so also have we
been because we assumed that um Cesar
took care of it sort of so the
coordination so uh we ended up in some
funny uh shats with with interesting
guys doing this uh DS defensing
staff
and yeah and from from there we also had
uh uh um we were discussing and also uh
sometimes monitoring the things together
so the active monitoring um after the
publication nothing happened there right
up was a funny picture uh we saw in that
correlation like H okay nothing is
moving here so let's go
on uh actually then something happened
what you can see here is um so we have
again world map with some red dots on it
the red dots are the systems which had
which had been primed by someone and uh
the green dots uh yeah obviously which
not and what you see on the right corner
is like a map um crypto has created
which is at his wall with some LEDs
behind it is some project he published
some years ago which I found pretty
funny so he does not need to look at his
locks or monitor he just entering his
room and see at his wall if there is
something going on or
not um
yeah open and Firefox n probably
not okay tooling um we're coming to the
end now and uh going to uh having the
topic tooling so there are some tools uh
we had researched this already um before
and uh uh took the freedom of create uh
some tools for uh investigating this and
other issues and um
then uh then this VM where hex started
we um thought okay now it's really time
also to publish all those things and one
of the things uh was SLP scan which was
formerly called SLP or SL Punisher then
thought okay maybe SLP scan is a bit
more
friendly and
um when this was published this is
actually a down strip version which does
not allow you to uh misuse it so they
have several things have been removed
however you can still investigate Sip
and those things yeah oh yeah and if you
don't like SLP scan for what reason ever
there's also still open
SLP uh software you can install on your
device or maybe have and try to
investigate with
that
um this is an simple example how you can
use SLP scan it has uh two modes one
mode is um that you uh have a predefined
service operation and that uh it's a
service request for version two and uh
just uh give an IP address and it will
just ask this remote system and figures
out if there's response plus it has a
so-call calleded probe mode where you
can add your own probes in adjacent file
and then just call that with the command
line to see how this reacts
so this on an example from from last
week I think with some random device uh
in the inters and here we have actually
two different sorts of R types um
operations one is the classic service
request and then uh you also see the
difference between a service request and
a service type
request then there's SLP load SLP load
supports you on figuring out how much uh
device can can be primed so are your
devices vulnerable and um if you use
this one you uh just um give the packet
size how much you try to load it up with
and the IP and then it will um trying to
load data into step by step by step and
also gives you the amplification
Factor yeah open SLP if you want to do
it by open SLP default
tools besides this vulnerability you of
course can do it uh use it for other
things because well you can put there
1,500 bytes so you can also store some
sort of information and you can specify
lifetime you can specify a handle it
will not be hard to base en code it to
encrypt it whatsoever what's funny about
this is again as we can spoof we can at
least for adding the information sort of
anonymously if you want to read it out
probably
not depends on maybe you can also do
some funny reflection there
and of course even though if if UDP
wouldn't be uh there anymore you still
do it via TCP which is as I said at the
beginning SLP has been defined for TCP
and UDP however you don't have this
boofing
part uh normally with
TCP if the data however you can store
with SLP is not enough if you want to
store data you maybe can go with
something like a Global pjl Network um
which was sold introduced already around
2000 by
F then C2 infrastructure of course as
you can store their information you can
also abuse it for that adding uh some
sip to your C2 infrastructure and have
your uh main system
there what would be also funny is if
someone is using or doing a global
defense because you don't have only the
regist registration service but you also
have to D registration so what stops you
from removing a service which is already
there like this would be also funny so
we were thinking okay what happens if
you monitor all the devices uh let let's
say one hour per day and then if you see
okay there's some primary ongoing you
just unpre it again that was a funny
thought um references so as soon as I
have published the slides which might
take some more days you can also check
out the references or make a photo show
and questions I'm at the end of my talk
thank
[Applause]
you thank you Dash um for this lovely
presentation in these very warm
afternoon hours um do we have any
questions from the
audience no questions
asked don't be
shy
you see even go this
year okay oh there's a question over
there we have a question is it about
graffle no not about
graffle um I missed short part of your
talk I'm not sure if you answered this
uh have you seen any attacks in the wild
using
this I'm not aware of yet I have seen uh
uh we have seen the prime the
preparations you have seen PR
preparation
but um um as we are not able to monitor
every as we we don't know no I cannot
tell you about this maybe there is uh
maybe we maybe if other sources tell us
about it U which I haven't checked for
time um we could publish something about
this about ongoing attacks but my
current answer is no thank
you we have one question from the
internet yes the internet asks uh give
the age of the protocol the strength
yield of of the amplification and the
large number of products and vendors
what are your thoughts on how this went
unnoticed for so
long the internet is huge there's a lot
of things going on and the it's the the
the the fun fact I mean this is almost
going into a philosophical quest uh
Direction because the fun thing is uh we
only know what we what we can see what
we know what we already researched and
we cannot know what we haven't
researched yet and there's a ton of
things if you check out for for daily
publishing even of uh major and critical
vulnerabilities the lists are endless
and if you imagine of all the things you
don't know I think this is um I think
there's a lot of other things we we
don't know yet or people have not
published also uh from my point of view
I doubt that we have been the first one
recognizing it and I mean we saw it we
okay interesting we we had just been uh
the the first one saying okay we make
this now public right so uh I can
imagine that uh people have seen this I
mean we know that that not every
research is
published okay any further
questions
that does not seem to be the case so uh
thanks again dash for this lovely talk
and thanks K and then
um have a pleasant
[Applause]
[Music]
day